American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed

The FBI's Internet Crime Complaint Center recorded 193,407 phishing and spoofing complaints in 2024, making it one of the most frequently reported categories of internet crime. In 2025, the FBI recorded more than 1 million internet crime complaints and $20.9 billion in reported losses, with reported losses increasing by 26% compared with the previous year. This financial impact highlights the urgent need for organizations to adapt their defenses against evolving attack techniques.

Attackers are also adapting to organizations that have invested heavily in identity security and multi-factor authentication (MFA). Device code phishing is one example of this adaptation. Rather than collecting credentials through a fake login page, an attacker can initiate a legitimate device authorization flow and convince the victim to complete it. The resulting authentication tokens can then provide access to resources available to the compromised account.

The Skyw4lker campaign starts with a lure designed to resemble normal business correspondence. Victims receive a password-protected document presented as a contract or service proposal. The scenario is credible in environments where employees routinely exchange vendor agreements, procurement documents, statements of work, and similar files. From the document, the victim is directed toward a page hosted on sites[.]google[.]com, which eventually leads into a Microsoft authentication flow.

The attacker does not need to reproduce Microsoft's login experience perfectly. The authentication itself can be legitimate; the deception is in convincing the victim to complete an authentication request initiated by the attacker. Once the process is completed, the attacker can obtain access to the resulting Microsoft 365 tokens. That makes the attack difficult to evaluate through identity telemetry alone.

An organization may see a valid authentication event without immediately seeing the malicious context that caused it. Establishing what happened requires the security team to connect the document, web activity, authentication flow, and associated infrastructure. A static inspection of the original document may reveal the starting URL, but it cannot fully explain what happens once the victim interacts with the page. The malicious behavior emerges through the combination of browser activity, JavaScript execution, backend communication, redirects, and authentication.

The web infrastructure used by Skyw4lker provides additional evidence of the campaign's operation. ANY.RUN's analysis identified obfuscated JavaScript and a PHP backend used to create a victim session, collect information such as IP address and geolocation, and repeatedly poll the backend while waiting for the authentication process to complete. This infrastructure is designed to facilitate the attack while remaining difficult to trace.